Implement CHUNK #2: server layer, core schemas/adapters, contract tests, seed

Complete the server-backed storage layer for PubScript so the app can run
against a real Fastify + SQLite backend instead of only local IndexedDB.

Server (@pubscript/server):
- db.ts: better-sqlite3 schema + migrations (users, shares, projects, books,
  chapters, entities, boards, ai_sessions, audit); WAL mode; idempotent
  admin bootstrap via PUBSCRIPT_ADMIN_EMAIL/PASSWORD.
- auth.ts: argon2 hashing, JWT-ish session tokens, guards, auth routes.
- routes.ts: REST CRUD for projects/books/chapters/entities/boards/ai_sessions
  with multi-tenant isolation and optimistic concurrency (baseRev).
- ws.ts: Fastify websocket hub for autosave + presence events.
- mapping.ts: row <-> core type conversion.

Core (@pubscript/core):
- Zod domain schemas (projects, books, chapters, entities, boards, ai_sessions)
  exported from index.
- storage-local.ts (IndexedDB/Dexie) and storage-server.ts (REST) adapters
  implementing the StorageAdapter contract.

Tests & tooling:
- storage.contract.test.ts: parameterized over both adapters; wired as
  `pnpm contract` and added to CI.
- seed.ts (`pnpm --filter server seed`): creates demo project "The Glass Harbor"
  — 3 chapters of prose, 4 linked characters, 1 world location, 6-node board.
- Dockerfile + compose wiring for the server runtime.

Acceptance: seed project opens with 3 chapters, 4 linked characters, 1 board.

server/src/config.ts

@@ -0,0 +1,42 @@
+/**
+ * Environment-driven server configuration.
+ *
+ * All values are read from `process.env` at import time with sensible
+ * defaults so the server boots with zero configuration for local dev.
+ */
+
+function env(key: string, fallback: string): string {
+  const value = process.env[key];
+  return value === undefined || value === "" ? fallback : value;
+}
+
+function envInt(key: string, fallback: number): number {
+  const raw = process.env[key];
+  if (raw === undefined || raw === "") return fallback;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) ? n : fallback;
+}
+
+export interface ServerConfig {
+  /** Path to the SQLite database file. */
+  dbPath: string;
+  /** Port the HTTP server listens on. */
+  port: number;
+  /** Origin allowed for CORS. */
+  origin: string;
+  /** Email of the bootstrap admin user. */
+  adminEmail: string;
+  /** Session token TTL in seconds. */
+  tokenTtl: number;
+  /** Version string reported by /api/version. */
+  version: string;
+}
+
+export const config: ServerConfig = {
+  dbPath: env("PUBSCRIPT_DB", "./data/pubscript.sqlite"),
+  port: envInt("PORT", 8080),
+  origin: env("PUBSCRIPT_ORIGIN", "http://localhost:5173"),
+  adminEmail: env("PUBSCRIPT_ADMIN_EMAIL", "admin@pubscript.local"),
+  tokenTtl: envInt("PUBSCRIPT_TOKEN_TTL", 60 * 60 * 24 * 30),
+  version: env("PUBSCRIPT_VERSION", "0.1.0"),
+};